Critical Remote Code Execution Flaw Patched in Veeam ONE Backup Management Product
Veeam Software has disclosed multiple serious vulnerabilities in its backup environment operations management product Veeam ONE. The company published a security advisory on July 29, 2026, confirming that six vulnerabilities have been resolved in the latest release.
The most critical issue, identified as CVE-2026-64633, affects the agent host component and allows remote code execution without any authentication. The flaw received the maximum CVSS v4.0 base score of 10.0 and has been rated Critical, the highest severity level in the four-tier scale.
Another notable vulnerability, CVE-2026-58075, enables unauthenticated reading of arbitrary files, which can subsequently lead to local privilege escalation. This issue was assigned a CVSS base score of 8.7.
Veeam has made updated versions available that address all six vulnerabilities. Organizations running Veeam ONE are strongly advised to apply the fixes without delay to prevent potential exploitation of the remote code execution flaw.
Related articles
Sky Discloses Five Vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
Sky has released a security advisory detailing five vulnerabilities affecting its IT asset management tools SKYSEA Client View and SKYMEC IT Manager. The flaws impact all Windows-based components including master servers, management machines, terminal machines, and standalone terminals. Two issues received CVSSv4 base scores of 8.5 while the remaining three scored 5.8, with CVSSv3 scores reversing the severity ranking for some entries. The vulnerabilities include missing authorization checks, improper file permissions during installation, multiple path traversal flaws, and a stack-based buffer overflow. Sky has made update and patch modules available to contracted customers and strongly recommends immediate deployment.
CISA Adds Oracle WebLogic Proxy Plug-in Flaw CVE-2026-21962 to KEV Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog, confirming active exploitation of the Oracle WebLogic Server Proxy Plug-in. The vulnerability affects the mod_wl_ohs module that proxies requests from web servers to Oracle WebLogic Server. It is bundled with Oracle HTTP Server and also impacts equivalent plug-ins for Apache HTTP Server and IIS. The flaw allows unauthenticated remote attackers to tamper with, delete, or create data and exfiltrate information. Exploitation can impact connected environments and backend systems. CISA issued the alert on August 24, 2026, highlighting the risk to organizations running affected proxy configurations.
Critical Zoom Vulnerability Exposes All Platforms to Remote Takeover via Screen Sharing Annotations
A high-severity vulnerability in Zoom Workplace clients across Windows, Mac, iOS, Android, and Linux allows attackers to remotely seize full device control simply by having a victim enable screen sharing and the annotation tool. The flaw requires no user interaction such as clicking links or dismissing warnings, and the compromise occurs silently without visible alerts. Security researchers demonstrated that AI tools enabled complete exploit development within 24 hours, dramatically lowering the barrier for advanced attacks previously limited to nation-state actors. The issue affects hundreds of millions of remote workers who rely on Zoom’s daily screen-sharing features. Official patches have been released, and users are urged to update immediately while avoiding annotation tools in sensitive sessions. Apple simultaneously addressed related macOS flaws in multiple versions. The incident highlights how generative AI is accelerating the weaponization of vulnerabilities.
Windows 11 May Silently Remove Discrete GPU Drivers Due to Eco Mode on Gaming Laptops
Windows 11 has introduced an unexpected behavior that can delete drivers for discrete graphics cards on gaming laptops when the device remains powered off for an extended period in Eco Mode. The issue was first reported by the owner of an Asus ROG Zephyrus G14 equipped with a mobile GeForce RTX 5070 Ti, where the system treated the physically disconnected GPU as permanently removed after 15 days. Windows component pnpclean.dll then purged both the device entry and the associated Nvidia driver package, leaving the laptop with only a Microsoft Basic Display Adapter reporting error code 10. The default cleanup timer is normally 30 days, but it can be shorter for certain hardware configurations that fully disconnect discrete graphics for power saving. Similar incidents have been observed on older Asus ROG models with AMD Radeon GPUs, prompting the developer of G-Helper to add a warning to the utility. Users can mitigate the problem by periodically switching to Standard Mode or by disabling automatic driver package cleanup via a specific PowerShell command that sets the Autorun value to 0 under the Device Driver Packages registry key. Microsoft has not yet issued an official statement on the matter.